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MEMORANDUM  FOR  DIRECTOR,  DEFENSE  INFORMATION  SYSTEMS  AGENCY 

SUBJECT;  Report  on  Compliance  with  the  Federal  Managers'  Financial  Integrity  Act  at 
the  Defense  Commercial  Communications  Office  (Project  No.  2RE-2015.01) 


Introduction 

We  are  providing  this  final  report  for  your  information  and  use.  It  discusses 
compliance  with  the  Federal  Managers'  Financial  Integrity  Act  of  1982  (FMFIA) 
at  the  Defense  Commercial  Communications  Office  (DECCO). 

The  FMFIA  requires  each  executive  agency  to  periodically  evaluate  its  system  of 
internal  controls  and  to  report  annually  to  the  President  and  the  Congress.  An 
agency's  report  should  state  whether  its  system  complies  with  the  requirements  of 
the  FMFIA  and  should  identify  material  internal  control  weaknesses,  if  any,  and 
plans  for  correcting  the  weaknesses. 


Audit  Results 

DECCO 's  internal  control  program  was  not  in  full  compliance  with  the 
requirements  of  the  FMFIA.  Those  requirements  are  implemented  in  Office  of 
Management  and  Budget  (0MB)  Circular  A-123,  "Internal  Control  Systems," 
August  4,  1986;  DoD  Directive  5010.38,  "Internal  Management  Control 
Program,"  April  14,  1987;  and  Defense  Information  Systems  Agency  (DISA) 
Instruction  630-125-6,  "DCA  [Defense  Communications  Agency]*  Internal 
Management  Control  Program,"  July  23,  1987.  DECCO's  program  needed 
improvements  in  the  areas  of  FMFIA  performance  standards,  risk  assessments, 
internal  control  evaluations,  and  FMFIA  training.  DISA  has  issued  supplementary 
guidance  and  directed  that  specific  improvement  actions  be  taken  in  those  areas.  If 
actions  are  implemented  by  DECCO,  the  conditions  disclosed  by  the  audit  will  be 
corrected. 


Objectives 

The  overall  audit  objective  was  to  determine  whether  FY  1992  financial  statements 
for  the  Defense  Business  Operations  Fund-Communications  Information  Services 
Activity  were  presented  fairly  in  accordance  with  generally  accepted  accounting 


*  Now  the  Defense  Information  Systems  Agency 


principles.  We  also  evaluated  applicable  internal  controls  and  assessed  compliance 
with  laws  and  regulations  for  transactions  and  events  having  a  direct  and  material 
effect  on  the  financial  statements.  This  report  discusses  only  the  FMFIA  aspects  of 
our  objective  to  assess  compliance  with  laws  and  regulations.  A  separate  report 
will  be  issued  on  assessments  of  compliance  with  other  applicable  laws  and 
regulations,  the  financial  statements,  and  internal  controls. 


Scope 


The  Five  Year  Management  Control  Plan  (MCP),  September  17,  1991,  which  was 
included  as  part  of  DECCO's  FY  1991  Annual  Statement  of  Assurance  to  DISA, 
showed  that  DECCO  assessed  12^  of  its  36  assessable  units  during  FY  1991.  The 
MCP  indicated  that  each  unit  is  assessed  at  least  once  every  5  years.  The  12  units 
assessed  in  FY  1991  were  scheduled  to  be  reassessed  in  FY  1996.  Our  audit 
focused  on  the  FMFIA  work  performed  for  the  12  units  assessed  in  FY  1991. 

We  discussed  the  system  of  internal  controls  with  managers  at  DISA  and  DECCO 
to  determine  whether  controls  had  been  established  and  to  ensure  conipliance  with 
the  regulatory  provisions  of  OMB  Circular  A-123  and  DoD  Directive  5010.38. 
We  examined  and  evaluated  FMFIA  policies  and  procedures  for  each  of  the 
12  assessable  units.  We  interviewed  the  assessable  unit  manager;  reviewed  the 
1991  risk  assessment  documents;  and  determined  whether  internal  control  reviews 
were  performed  and,  if  so,  the  extent  of  those  reviews. 

This  financial  related  audit  was  made  in  accordance  with  auditing  standards  issued 
by  the  Comptroller  General  of  the  United  States  as  implemented  by  the  Inspector 
General,  DoD,  and  accordingly  included  such  tests  of  internal  controls  as  were 
considered  necessary.  The  audit  was  made  at  DISA,  Washington,  D.C.,  and 
DECCO,  Scott  Air  Force  Base,  Illinois. 


Internal  Controls 

We  evaluated  the  effectiveness  of  DECCO’s  internal  controls  applicable  to  FMFIA 
performance  standards,  the  risk  assessment  process,  completed  internal  control 
reviews,  and  FMFIA  training.  Although  internal  control  deficiencies,  as  defined 
by  the  FMFIA,  OMB  Circular  A-123,  and  DoD  Directive  5010,38,  were  disclosed 
by  the  audit,  the  DISA  had  taken  actions  during  the  audit  to  correct  the 
deficiencies. 


Prior  Audits  and  Other  Reviews 

IG,  DoD,  Report  No.  89-015,  "Report  on  the  Fiscal  Year  1988  Evaluation  of  the 
Implementation  of  the  Federal  Managers’  Financial  Integrity  Act  of  1982  at  the 
Defense  Communications  Agency,"  October  21,  1988,  concluded  that  the  Defense 


2  Ten  managers  made  the  twelve  assessments;  two  managers  assessed  two  units 
each. 
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Communications  Agency's  Accounting  System  Evaluation  and  Reporting  process  at 
the  Communications  Services  Industrial  Fund  was  in  compliance  with  the  Federal 
Managers'  Financial  Integrity  Act  and  with  0MB  Circular  No.  A- 127, 
"Financial  Management  Systems,"  for  FY  1988.  The  FY  1988  evaluation  did  not 
include  an  analysis  of  the  internal  management  program  results  or  the  efficiency 
and  effectiveness  of  the  procedures  used  in  the  implementation  of  the  FMFIA. 


Background 

The  DECCO  is  headquartered  at  Scott  Air  Force  Base,  Illinois.  The  DECCO,  a 
field  organization  of  the  Defense  Information  Systems  Agency,  is  responsible  for 
the  acquisition  of  telecommunication  services  and  equipment  on  behalf  of  its  DoD 
and  65  other  Federal  agency  customers.  The  DECCO  is  responsible  for 
administering  about  89,000  contracts  valued  at  $1.2  billion  annually.  Some  of  the 
communications  services  and  equipment  DECCO  acquires  for  its  customers  are 
basic  telephone  circuits  and  networks,  fiber  optics,  video  teleconferencing, 
satellites,  and  packet  switching  (transfer  of  communication  bundles). 

DoD  Directive  5010.38  requires  managers  of  ^sessable  units  to  conduct  risk 
assessments  and  internal  control  evaluations  of  assigned  units,  as  necessary,  at  least 
every  5  years  to  ensure  that  the  system  of  internal  controls  is  working  in 
accordance  with  General  Accounting  Office  (GAO)  standards.  DISA  Instruction 
630-125-6  implements  DoD  Directive  5010.38  and  provides  guidance  on  risk 
assessments,  internal  control  evaluations,  and  internal  management  control 
responsibilities  for  the  DISA  and  its  field  organizations.  The  Instruction  mandates 
specific  documentation  requirements  for  internal  control  evaluations  and  requires 
that  supervisors  evaluate  assessable  unit  managers  annually  on  FMFIA 
responsibilities.  Supplement  1  of  the  Instruction,  "Risk  Assespents  and  Internal 
Management  Control  Reviews,"  issued  in  March  1988,  includes  additional 
guidance  on  performing  risk  assessments  and  internal  management  control  reviews. 
The  Supplement  also  details  the  methodology  to  be  followed  in  conducting 
reviews,  to  include  identifying  work  flow,  assessing  controls,  testing  controls,  and 
reporting  and  following  up  on  internal  control  weaknesses. 

Enclosure  1  describes  specific  requirements  for  risk  assessments,  internal  control 
evaluations,  documentation,  and  evaluation  of  assessable  unit  managers'  FMFIA 
responsibilities. 


Discussion 

DECCO 's  FY  1991  internal  control  program  did  not  comply  with  DISA 
Instruction  630-125-6  in  the  areas  of  FMFIA  performance  standards,  risk 
assessments,  internal  control  evaluations,  and  FMFIA  training.  However,  DISA 
issued  guidance  and  direction  during  the  audit  that,  if  implemented,  will  result  in 
DECCO's  compliance  in  those  areas.  The  conditions  and  corrective  actions  are 
discussed  below. 
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Performance  Standards.  Generally,  internal  control  responsibilities  were  not 
included  in  the  managers'  performance  plans,  and,  when  they  were  included,  they 
were  not  designated  as  a  critical  element.  FMFIA  responsibilities  were  not 
included  in  performance  plans  for  6  of  10  assessable  unit  managers  and,  therefore, 
the  managers  were  not  evaluated  on  their  internal  management  control  program 
duties.  Performance  plans  for  the  remaining  four  managers  included  FMFIA 
responsibilities,  but  for  three  managers'  performance  plans,  the  responsibilities 
were  not  designated  critical  elements.  The  remaining  manager  was  evaluated  for 
FMFIA  responsibilities,  and  the  responsibilities  had  been  designated  as  a  critical 
element. 

DISA  Instruction  630-125-6  requires  that  the  directors  of  DISA  field  organizations 
include  FMFIA  responsibilities  in  an  assessable  unit  manager's  performance  plan 
as  a  critical  element  in  order  to  ensure  maximum  effort  in  implementing  the 
FMFIA  program.  In  March  1993,  DISA's  Internal  Management  Control  (IMC) 
focal  point  sent  the  DECCO  IMC  focal  point  a  sample  performance  plan  and 
directed  that  FMFIA  responsibilities  be  included  as  a  critical  element  in  all 
assessable  unit  managers'  performance  plans.  By  including  those  responsibilities 
as  a  critical  element  in  the  performance  plan  as  directed  by  DISA,  DECCO  will  be 
in  compliance  with  FMFIA  requirements. 

FY  1991  Risk  Assessments.  FY  1991  risk  assessments  did  not  include  sufficient 
information  to  support  managers'  decisions  on  identifying,  evaluating,  and  testing 
internal  control  techniques.  The  risk  assessment  documents  did  not  provide 
reasonable  assurance  to  third  parties  that  controls  were  in  place  and  worked  as 
intended  (see  Enclosure  2).  Only  two  documents  referenced  supporting  evidence 
that  techniques  had  been  tested.  Despite  seven  medium-risk  ratings,  DECCO's 
assessment  documents  concluded  that  no  further  action  was  necessary  because 
safeguards  were  in  place  to  counter  risks.  However,  the  assessment  documents  did 
not  mention  what  the  safeguards  were  or  whether  the  safeguards  worked.  In 
addition,  assessable  unit  mangers  told  the  audit  team  that  they  had  not  documented 
the  "safeguards"  specified  in  their  risk  assessment  documents.  Internal  control 
focal  points  for  both  the  DISA  and  DECCO  said  that  risk  documents  were  neither 
informative  nor  convincing. 

In  an  August  12,  1992,  memorandum  to  all  field  organizations,  the  DISA 
Comptroller  questioned  the  risk  assessment  process  used  during  the  FY  1988  to 
FY  1992  period.  The  memorandum  stated  that  "since  our  managers  reported  that 
virtually  no  risk  existed  in  the  agency,  few  follow-on  reviews  or  corrective  actions 
were  performed,"  but  that  "it  is  not  credible  that  our  agency  would  be  mostly 
without  risk.  ,  .  .  Accordingly,  we  will  implement  some  changes  in  the  approach 
to  the  Internal  Management  Program  for  FY  93-97."  He  directed  that  top-level 
field  managers  participate  in  the  risk  evaluation  process,  consolidate  assessable 
units  to  enhance  risk  identification,  and  prioritize  risk  areas  to  ensure  that 
resources  are  used  in  the  most  important  risk  areas.  By  implementing  those 
directed  improvements  to  the  risk  assessment  process,  DECCO  will  be  in 
compliance  with  the  FMFIA  requirements. 
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Internal  Control  Evaluations.  For  8  of  the  12  units  assessed,  internal  control 
evaluations  or  alternative  reviews  were  not  performed  to  provide  reasonable 
assurance  that  internal  control  techniques  were  adequate  and  worked.  Risk 
assessment  documents  showed  that  medium  risk  ratings  were  assigned  to  seven 
of  the  eight  assessable  units.  One  unit  was  assigned  its  risk  rating  based  on 
external  testing.  For  the  remaining  three  assessable  units,  limited  control  tests 
were  performed  (see  Enclosure  2). 

The  control  tests  for  the  three  assessable  units  were  not  in  full  compliance  with 
DISA  Instruction  630-125-6.  For  example,  documentation  supporting  the  tests  did 
not  identify  control  objectives  or  control  techniques  and  did  not  define  test 
objectives,  testing  universe,  and  sampling  methodology.  However,  the  tests 
included  cross-references  of  account  balances  and  reconciliations  to  supporting 
documents.  Therefore,  we  believe  the  tests  provided  reasonable  assurance  that  the 
financial  transactions  were  accurate  and  supported. 

During  the  audit,  DISA  initiated  actions  to  ensure  increased  internal  control  testing 
by  assessable  unit  managers.  In  the  August  12,  1992,  memorandum  mentioned 
above,  the  DISA  Comptroller  mandated  that  at  least  10  tests  were  to  be  performed 
over  the  next  5  years  for  each  major  program  and  functional  area  to  ensure  a 
reasonable  level  of  testing  of  the  most  important  controls  within  a  major  program 
or  function.  The  memorandum  stressed  that  top-level  managers  at  each 
organization  should  be  directly  involved  in  control  test  planning  and 
implementation.  By  implementing  directed  improvements  in  internal  control 
testing,  DECCO  will  be  in  compliance  with  FMFIA  requirements. 

FMFIA  Training.  Adequate  training  was  not  provided  to  personnel  with  internal 
management  control  responsibilities.  None  of  the  10  assessable  unit  managers 
received  FMFIA  training  in  FY  1991.  Six  of  ten  assessable  unit  managers  had  not 
received  FMFIA  training  in  the  past  5  years.  In  April  1993,  DISA,  at  DECCO's 
request,  conducted  a  training  session  on  FMFIA  requirements  for  DECCO 
assessable  unit  managers.  Future  training  sessions,  when  requested,  will  also  be 
conducted.  Therefore,  no  further  corrective  action  is  required  on  FMFIA  training. 


Management  Comments 

We  provided  a  draft  of  this  report  to  the  addressee  on  June  15,  1993.  The  DISA 
provided  comments  (Enclosure  3)  on  July  1,  1993.  The  DISA  concurred  with  the 
report,  stating  DISA  will  take  follow-up  actions  to  ensure  that  established 
procedures  are  followed  and  that  the  FMFIA  program  is  implemented  effectively. 
The  comments  also  stated  that  the  DECCO  was  a  participant  in  detecting  and 
correcting  two  material  internal  control  weaknesses  reported  during  the  audit 
period.  DISA  indicated  further,  that  the  detection  of  the  weaknesses  suggests  that 
DECCO  is  performing  internal  control  evaluations,  but  not  adequately 
documenting  them. 
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There  are  no  unresolved  issues  on  this  report;  therefore,  additional  comments  are 
not  required. 


The  courtesies  extended  to  the  audit  staff  are  appreciated.  If  you  have  questions  on 
this  audit,  please  contact  Mr.  John  M.  Donnelly  at  (703)  692-2899 
(DSN  222-2899)  or  Ms.  Mary  Lu  Ugone  at  (703)  692-3320  (DSN  222-3320). 
Copies  of  this  report  will  be  distributed  to  the  organizations  listed  in  Enclosure  4. 


Robert  J.  Lieberman 


Assistant  Inspector  General 
for  Auditing 


Enclosures 
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FMFIA  Program  Requirements 


Risk  assessments,  internal  control  evaluations,  documentation,  and  internal 
management  control  (IMC)  responsibilities  are  elements  that  each  executive 
agency  must  consider  in  its  evaluation  of  compliance  with  the  FMFIA. 

Risk  Assessments.  A  risk  assessment  is  used  to  determine  the  potential  for 
fraud,  waste,  abuse,  or  mismanagement  within  a  program  or  function.  The  risk 
assessment  helps  the  manager  weigh  the  safeguards  against  the  risks  associated 
with  a  unit’s  program  or  functions.  Risk  assessments  should  be  documented  and 
should  provide  a  reasonable  basis  for  an  assessable  unit's  risk  rating.  Risk 
assessments  are  required  whenever  the  risk  changes,  or  at  least  every  5  years. 
Managers  must  review  their  units  annually  to  ensure  that  proper  controls  are  in 
place  and  to  prepare  revised  risk  assessments  if  changes  occur  in  the  risks  or 
controls.  DISA  Instruction  630-125-6  emphasizes  that  risk  assessments  are 
preliminary  tools  in  the  FMFIA  process.  Managers  may  follow  up  with  internal 
control  reviews,  which  are  detailed  analyses  of  the  unit's  process  to  determine 
whether  controls  should  be  adjusted. 

Internal  Control  Evaluations.  An  internal  control  evaluation  includes  detailed 
tests  of  a  program  or  administrative  orjganization  to  determine  whether  adequate 
techniques  exist  and  have  been  implemented  to  achieve  cost-effective 
compliance  with  the  FMFIA.  There  are  two  types  of  internal  control 
evaluations:  internal  control  reviews,  which  are  detailed  examinations  of  a 
system  of  internal  controls;  and  alternative  IMC  reviews,  which  include  audits, 
investigations,  studies,  and  other  management  and  consulting  reviews. 

Documentation.  Documentation  is  a  key  requirement  of  the  FMFIA  process. 
Documentation  on  internal  control  evaluations  must  show  the  type  and  scope  of 
review;  responsible  officials;  pertinent  dates  and  facts;  key  findings;  and  when 
appropriate,  recommended  corrective  actions.  All  documentation  must  show  the 
control  testing  procedures  used.  Those  procedures  include  observation, 
sampling,  examination,  verification,  or  other  procedures  to  ensure  that  internal 
control  systems  are  working  in  accordance  with  internal  control  objectives  and 
GAO  standards. 

Documentation  for  each  internal  control  review  must  show  how  the  review  was 
done  and  what  was  found.  Documentation  for  each  alternative  IMC  review 
must  show  whether  compliance  with  the  FMFIA  has  been  determined  and  that 
testing  of  controls  has  been  performed. 

IMC  Responsibilities.  DISA  Instruction  630-125-6  states  that  directors  of 
DISA  field  organizations  will  ensure  that  civilian  and  military  managers  with 
internal  management  control  responsibilities  are  identified  and  that  performance 
standards  include,  as  a  critical  element,  internal  management  control 
responsibilities.  The  Instruction  requires  that  field  organization  officials  certify 
by  September  1  of  each  fiscal  year  whether  internal  management  controls  are  in 
place  and  working. 
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ENCLOSURE  1 


Defense  Commercial  Communications  Office  FY  1991 
Risk  Assessments  and  Internal  Control  Evaluations 


Internal  Control 

Alternative 

Function/Assessable  Unit 

Risk 

Reviews 

Reviews 

Procurement 

Contract  Support  Division 

No 

Yes^ 

DECCO,  Pacific 

M^ 

No 

No 

Contract  Administration 

Strategic  Planning  Division 

M^ 

No 

No 

Contract  Policy  Division 

M^ 

No 

No 

Plans  and  Procedures  Division 

L 

No 

No 

Supply  Operations 

No 

Yes^’^ 

No 

Yes^’^ 

Supply  and  Equipment 

M^ 

Imprest  Fund 

L 

Information  Technology 

No 

Financial  Management 

M^ 

No 

Information  Management 

M^ 

No 

No 

Automatic  Data  Processing 

Equipment  Control 

M^ 

No 

No 

Comptroller/Resource  Management 

Disbursing  Funds^ 

L 

YesJ 

Yes^ 

Accounting  System^ 

L 

Yes^ 

Yes^ 

Legend:  H=High  M=Medium  L=Low 

See  footnotes  on  the  next  page. 


ENCLOSURE  2 
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Defense  Commercial  Communications  Office  FY  1991  Risk  Assessments  and  Internal  Control 
Evaluations 


1.  The  high-risk  rating  was  based  on  the  recent  IG,  DoD,  inspection 
referenced  in  footnote  2.  The  inspection  was  performed  from  April  23  to 
July  27,  1990.  The  assessment  document  for  this  unit  stated  that  although  the 
risk  was  high,  adequate  safeguards  were  in  place  to  counter  the  risks. 
However,  because  the  safeguards  were  not  specified,  their  effectiveness  is 
suspect. 

2.  The  alternative  internal  management  control  reviews  included  a 
completed  IG,  DoD,  inspection  concerning  the  Contract  Support  Division, 
("Defense  Communications  Agency  Inspection,"  Report  No.  91-INS-08, 
May  10,  1991)  and  ongoing  IG,  DoD,  audits.  No  other  alternative  reviews 
were  performed. 

3.  Risk  assessment  documents  for  the  seven  medium-risk  ratings 
included  statements  that  adequate  safeguards  were  in  place,  but  the  documents 
did  not  specify  the  safeguards.  In  addition,  no  internal  control  evaluations  were 
performed  by  the  managers  of  the  seven  units. 

4.  Based  on  discussions  with  appropriate  officials,  we  determined  that 
the  Imprest  Fund  unit  had  performed  internal  control  and  alternative  reviews; 
however,  the  risk  assessment  document  gave  no  indications  that  such  reviews 
were  performed. 

5.  The  internal  control  reviews  provided  only  limited  assurance  that 
adequate  controls  were  in  place  and  working. 

6.  The  risk  assessment  documents  for  the  assessable  unit  referenced  an 
internal  control  evaluation  and  quality  review  to  indicate  that  the  internal  control 
techniques  were  tested. 
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Defense  Information  Systems  Agency  Comments 


DEFENSE  INFORMATION  SYSTEMS  AGENCY 


701  8.  COURT  HOUSE  ROAD 
ARUNGTON.VA  222iH-Z\PQ 


ItSih:  CHI 


JUL 1993 


MEHORAHBUH  FOR  THE  IKSFECTOR  GEHERU,  DOD 

SUBJECT:  Draft  report  on  Complianae  with  the  Federal  Managers' 

Financial  integrity  Act  at  the  Defense  commercial 
communications  office  (Project  Ho.  2RE-201S.01) 

1.  We  have  reviewed  the  subject  report.  Overall/  we  concur  with 
the  findings  of  the  report.  As  noted  in  the  report,  both  DISA 
Headquarters  and  DECCO  have  taken  positive  actions  to  correct  the 
deficiencies  noted.  While  we  agree  with  the  audit  assessment,  it 
should  also  be  noted  that  of  the  two  DISA  Internal  control 
Material  weaknesses  reported  on  during  the  period  of  the  audit, 
DECCO  was  a  key  participant  in  the  identification  and  correction 
of  these  weaknesses.  Had  DECCO  documented  their  evaluations 
better,  it  is  DZSA's  position  that  the  audit  would  have  noted  a 
significant  amount  of  evaluation  of  the  risks  and  controls  of 
DECCO.  Since  current  DoD  program  emphasis  is  currently  on 
results,  not  process,  it  should  be  noted  that  DECCO  has  made 
positive  contributions  towards  improvement  of  agency  controls. 
Nevertheless,  for  a  program  to  be  fully  effective,  established 
agency  procedures  must  be  followed.  DISA  will  take  followup 
action  to  ensure  the  corrective  actions  underway  at  DECCO  and 
other  agency  elements  are  implemented  and  effective. 

2.  If  there  are  any  questions  regarding  this  response,  please 
contact  Mr.  Philip  Lavietes  or  Mr.  Bruce  Ingalls  at  (703)  692- 

4524. 


FOR  THE  DIRECTOR: 


GEOR^^  H0r| 
Comp  Roller 
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Office  of  the  Secretary  of  Defense 

Assistant  Secretary  of  Defense  (Command,  Control,  Communications  and  Intelligence) 
Comptroller  and  Chief  FinancM  Officer  of  the  Department  of  Defense 
Assistant  to  the  Secretary  of  Defense  for  Public  Affairs 

Director  for  Management  Improvement,  Deputy  Comptroller  (Management  Systems) 


Department  of  the  Army 

Auditor  General,  U.S.  Army  Audit  Agency 


Department  of  the  Navy 

Auditor  General,  Naval  Audit  Service 


Department  of  the  Air  Force 

Auditor  General,  U.S.  Air  Force  Audit  Agency 


Defense  Agencies 

Director,  Defense  Contract  Audit  Agency 
Director,  Defense  Finance  and  Accounting  Service 
Director,  Defense  Information  Systems  Agency 
Director,  Defense  Commercial  Communications  Office 
Director,  Defense  Intelligence  Agency 
Inspector  General,  Defense  Intelligence  Agency 
Director,  Defense  Logistics  Agency 
Director,  National  Security  Agency 
Inspector  General,  National  Security  Agency 
Director,  Defense  Logistics  Studies  Information  Exchange 


Non-Defense  Federal  Organizations 

Office  of  Management  and  Budget 
U.S.  General  Accounting  Office 

National  Security  and  International  Affairs  Division,  Technical  Information  Center 
Accounting  and  Financial  Management  Division 
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Non-Defense  Federal  Organizations  (cont'd) 

Chairman  and  Ranking  Minority  Member  of  Each  of  the  Following  Congressional 
Committees  and  Subcommittees: 

Senate  Committee  on  Appropriations 

Senate  Subcommittee  on  Defense,  Committee  on  Appropriations 

Senate  Committee  on  Armed  Services 

Senate  Committee  on  Budget 

Senate  Committee  on  Governmental  Affairs 

Senate  Subcommittee  on  Oversight  of  Government  Management,  Committee  on 
Governmental  Affairs 
Senate  Select  Committee  on  Intelligence 
House  Committee  on  Appropriations 

House  Subcommittee  on  Defense,  Committee  on  Appropriations 

House  Committee  on  Armed  Services 

House  Committee  on  Budget 

House  Committee  on  Government  Operations 

House  Subcommittee  on  Legislation  and  National  Security,  Committee  on 
Government  Operations 

House  Permanent  Select  Committee  on  Intelligence 

House  Subcommittee  on  Oversight  and  Evaluation,  Permanent  Select  Committee 
on  Intelligence 
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William  F.  Thomas  Director,  Readiness  and 

Operational  Support  Directorate 
Mary  Lu  Ugone  Program  Director 

John  Donnelly  Project  Manager 

Marian  V.  Barnwell  Team  Leader 
George  Cherry  Team  Leader 
Gilbert  A.  Nelson  Team  Leader 
Philip  T.  Davis  Auditor 
Susan  Huizenga  Auditor 
Kathleen  E.  Gant  Auditor 
Wesley  E.  Lewis  Auditor 
Robert  L.  Maiolatesi  Auditor 
Pamela  Smith  Auditor 
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